Searchlight – IMINT – TryHackMe Walkthrough

Introduction

The Searchlight – IMINT room is a training exercise focused on Image Intelligence (IMINT) and Geospatial Intelligence (GEOINT). Its aim is to teach participants how to extract location and contextual information from images and videos using observation, logical deduction, and OSINT tools.

The methodology involves:

• Understanding context and visual clues

• Distinguishing between foreground and background elements

• Identifying map-relevant markers (such as signs, streets, and landmarks)

• Utilizing tools like EXIF data extractors, reverse image search, and Google Dorking

• Applying trial and error to confirm or reject hypotheses

Step 1 – Street Identification via EXIF Data

The first image immediately revealed its location and also when I checked the EXIF metadata.
The copyright field contained the street name "Carnaby Street", confirming the answer without additional research.

Step 2 – London Underground Station

The next image showed a staircase leading to a London Underground station.

Based on the signage and with Google reverse image, I quickly determined it was Piccadilly Circus in London.
Additional research confirmed that:

• It opened in 1906

• It has 4 platforms

Step 3 – Vancouver International Airport

Another image showed what looked like a modern food court.

A visible web address in the scene included "yvr.ca", which is the official domain for Vancouver International Airport.
Searching for “YVR Connects” confirmed this was inside Vancouver International Airport in Richmond, Canada.

Step 4 – Locating a Coffee Shop in Scotland

Two café images were provided, showing a classic English breakfast.

In the background, the shop “The Edinburgh Woollen Mill” was visible. Since this is a chain, I had to pinpoint the exact branch.

A Google Images search for this shopfront matched the EWM outlet at Wellmeadow, Blairgowrie thanks to the distinct white brick wall and red windows. Using Street View, I confirmed that directly across the street is The Wee Coffee Shop.

From here I extracted with Google Maps and Facebook page:

• City: Blairgowrie

• Street: Allan Street

• Phone: +447878 839128

• Email: theweecoffeeshop@aol.com

• Owners’ surname: Cochrane

Step 5 – Katz’s Deli in New York

A restaurant image was analyzed using RevEye, a reverse image search extension that queries multiple engines (or you can just use Google Images).

The results clearly matched Katz’s Delicatessen in New York City.
A related Bon Appétit article revealed that the editor who worked there for 24 hours was Andrew Knowlton.

Step 6 – Rudolph the Chrome Nosed Reindeer in Oslo

The next challenge showed a chrome sculpture of a reindeer.

A reverse image search revealed it to be Rudolph the Chrome Nosed Reindeer, part of an art event in Oslo.

The tricky part was finding who took the exact photo. The solution came from the Visit Oslo website:

• Navigating to the Outdoor sculptures in Oslo, I found a Google My Maps with clickable pins.

• Clicking the pin for this sculpture revealed the original photographer’s name: Kjersti Stensrud.

Step 7 – Lady Justice in Alexandria, Virginia

This was one of the more challenging parts.

The image showed a blindfolded Lady statue, a common legal symbol.
Instead of relying only on reverse image search (which gave vague results), I switched to descriptive keyword search:

statue justice eyes blindfolded

This helped identify the statue as Lady Justice (also known as Themis).

The environment behind the statue was key — reflections on the glass building and the plaza was distinctive enough.
I eventually found a similar photo, but with a larger framing on a legal article, showing more of the surroundings.

From there, I ran a Yandex reverse image search on that broader photo. This returned an upward-angled shot that revealed the building’s name:

Albert V. Bryan United States Courthouse in Alexandria, Virginia.

Looking across the street on Google Street View, I identified the building opposite as The Westin Alexandria Old Town.

Step 8 – Hotel Identification from a Video

The last challenge was a video geolocation task.
Using ffmpeg, I extracted frames:

ffmpeg -i task9_1602643917499.mp4 frames/img%06d.png

At around 0:31, I can already tell it's in Singapore by the unique three-column building holding up an ocean liner (Marina Bay Sands). At the beginning of the video, it looks like we're facing a shopping mall, so I do a search on the following image, and it gives me the name: Clarke Quay.

Using Street View, I located the exact hotel with the same balcony view: the now-closed Novotel Singapore Clarke Quay.

Conclusion

This IMINT investigation combined:

• Metadata exploitation (EXIF)

• Context-based deduction from signage and architecture

• Reverse image search on both cropped and full images

• Descriptive keyword searching when reverse image fails

• Cross-referencing Street View and satellite imagery

• Video frame analysis for location matching

🛠 OSINT Tips – IMINT Investigations

• EXIF First: Metadata often provides instant answers if not stripped.

• Multiple Search Methods: If reverse image fails, try descriptive text search or partial crops.

• Background Matters: Reflections, skyline shapes, and road layouts are often better location indicators than obvious signs.

• Map Triangulation: Use Street View to confirm angles, distances, and object positions.

• Video to Frames: ffmpeg is invaluable for turning videos into searchable stills.

• Pivot on Context: Company names, URLs, and even art installations can lead to exact locations.